JGA • POLICIES
Data Security & Information Handling
J. Goldman & Associates LLC (“JGA”) takes reasonable steps to protect information entrusted to it during its advisory, engineering, and implementation work. This overview describes general practices; each engagement is also governed by its written agreement and the client’s applicable requirements. Last updated: November 10, 2026.
Scope of Services
JGA provides advisory, engineering, systems implementation, and related delivery services. JGA is not a general-purpose data hosting provider and does not operate or maintain client production systems or databases unless a written engagement expressly assigns that responsibility. Access to client systems or information is limited to the authorized scope of work and applicable agreements.
Access Control
Access is limited to personnel authorized for the engagement and only to the extent needed for assigned work. JGA follows client-defined access procedures and uses client-provided or client-approved credentials and permissions where applicable. Access should be removed or adjusted promptly when a person’s role changes or the engagement ends, subject to the client’s process.
Data Handling Practices
Client information is used only as needed to perform the authorized work. JGA seeks to minimize copying and use client-approved environments and channels for handling or transferring information. Client information is not placed in personal or unapproved storage unless the client has expressly authorized it. Return, deletion, or continued retention is handled under the engagement agreement, client instructions, and applicable legal obligations.
System and Communication Security
JGA uses work systems and communication methods appropriate to the engagement and follows client requirements for approved networks, collaboration tools, and file transfer. Encryption or other safeguards are used where supported, required, and applicable to the system or transfer. Personnel should not place sensitive client information in unsecured or personal storage. Specific controls can vary by client environment and contract.
Client Policy Alignment
JGA follows documented client information-security and IT governance requirements applicable to its work, including access procedures, handling rules, and reasonable review requirements. If a client requirement is unclear or conflicts with the agreed scope, JGA will raise it with the client so the parties can determine the appropriate handling before proceeding.
Confidentiality
JGA personnel and authorized resources are subject to confidentiality obligations through applicable agreements and engagement terms. Confidential information is used only for authorized business purposes and is not disclosed except as permitted by the client, the governing agreement, or law.
Third-Party and Subcontractor Controls
If a subcontractor or other third-party resource is engaged for client work, its access must be authorized for that work and subject to applicable confidentiality and data-protection obligations. Any client-specific approval or flow-down requirement in the engagement agreement will be followed.
Incident Response
If JGA becomes aware of a suspected security incident involving client information, JGA will notify the affected client promptly in accordance with the applicable agreement and client requirements, cooperate in the investigation, and take reasonable steps within its control to contain and address the issue. Contractual or legal notice deadlines control where they apply.
Continuous Improvement
JGA reviews its information-handling practices in light of engagement requirements and operational experience. This page is a general description, not a security certification or guarantee. Written client agreements and applicable client policies control where they set more specific requirements.
© JGA 2026
Advisory • Engineering • Automation • Implementation